Comments on: ShmooCon 2008: Unauthorized Phishing Awareness Exercise

By: macegr

macegr — Sat, 16 Feb 2008 20:35:07 +0000

good clarification, thanks. it just struck me as weird only because it seemed like such an easy metric to get.

By: Will O\'Brien

Will O\'Brien — Sat, 16 Feb 2008 19:39:11 +0000

Since his goal was awareness rather than user intelligence testing, he set up the form to do the same thing if submit or cancel were clicked. Many people hit the site several times, so simple hit counting didn’t reveal any usable numbers. (Users were behind a proxy, so IP address counting wasn’t an option either.

By: conrad

conrad — Sat, 16 Feb 2008 19:04:37 +0000

that is a valid question. “estimates that maybe 10%” is rather vague.

By: macegr

macegr — Sat, 16 Feb 2008 12:28:20 +0000

i think it’s a valid question, this is a conference about security, suspicion, and social engineering (e.g. fast talkers). once you start to make statements without citing facts, how is the audience supposed to figure out what actually happened versus what just sounds good at a hacker convention?

By: ian

ian — Sat, 16 Feb 2008 08:40:42 +0000

seriously macegr…

By: macegr

macegr — Sat, 16 Feb 2008 08:23:54 +0000

why does he have to “estimate maybe 10%”, wouldn’t it be a simple calculation involving the number of emails he sent out versus the number of times the “submit” button was pressed?